CVE-2007-4767
Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length...
Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length of (1) a \p sequence, (2) a \P sequence, or (3) a \P{x} sequence, which allows context-dependent attackers to cause a denial of service (infinite loop or crash) or execute arbitrary code.
Exploit likelihood
What each source reports
NVD Score used
Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length of (1) a \p sequence, (2) a \P sequence, or (3) a \P{x} sequence, which allows context-dependent attackers to cause a denial of service (infinite loop or crash) or execute arbitrary code.
- Record
CVE-2007-4767- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length of (1) a \p sequence, (2) a \P sequence, or (3) a \P{x} sequence, which allows context-dependent attackers to cause a denial of service (infinite loop or crash) or execute arbitrary code.
- Record
CVE-2007-4767- Updated
- 2026-11-02
EUVDEUVD-2007-4748 No score
Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length of (1) a \p sequence, (2) a \P sequence, or (3) a \P{x} sequence, which allows context-dependent attackers to cause a denial of service (infinite loop or crash) or execute arbitrary code.
- Record
EUVD-2007-4748- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9cw9-v886-c24m No score
Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length...
Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length of (1) a \p sequence, (2) a \P sequence, or (3) a \P{x} sequence, which allows context-dependent attackers to cause a denial of service (infinite loop or crash) or execute arbitrary code.
- Record
GHSA-9cw9-v886-c24m- Updated
- 2026-11-02
OSV No score
Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length of (1) a \p sequence, (2) a \P sequence, or (3) a \P{x} sequence, which allows context-dependent attackers to cause a denial of service (infinite loop or crash) or execute arbitrary code.
- Record
CVE-2007-4767- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-4767 No score
Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length of (1) a \p sequence, (2) a \P sequence, or (3) a \P{x} sequence, which allows context-dependent attackers to cause a denial of service (infinite loop or crash) or execute arbitrary code.
- Record
DEBIAN-CVE-2007-4767- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glib2.0Debian:12 |
before 2.14.3-1 | 2.14.3-1 |
glib2.0Debian:13 |
before 2.14.3-1 | 2.14.3-1 |
glib2.0Debian:14 |
before 2.14.3-1 | 2.14.3-1 |
pcre3Debian:12 |
before 7.3-1 | 7.3-1 |
pcre3Debian:3.1 From an advisory covering 7 CVEs |
before 4.5+7.4-1, plus listed versions 4.5-1.24.5-1.2sarge1 |
4.5+7.4-1 |
pcre3Debian:4.0 From an advisory covering 7 CVEs |
before 6.7+7.4-2, plus listed versions 6.7+7.4-16.7-1 |
6.7+7.4-2 |
kazehakaseDebian:4.0 From an advisory covering 10 CVEs |
before 0.4.2-1etch1, plus listed versions 0.4.2-1 |
0.4.2-1etch1 |
pcre3Debian:5.0 From an advisory covering 7 CVEs |
before 6.7+7.4-2+lenny1 | 6.7+7.4-2+lenny1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| aliases | ||
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-4767 is a medium vulnerability (CVSS 5.0) in Pcre, published November 5, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.07%, the 92nd percentile. Fixed in glib2.0 2.14.3-1.
References
secunia.com/advisories/30219
usn.ubuntu.com/547-1
security.gentoo.org/glsa/glsa-200711-30.xml
vupen.com/english/advisories/2007/4238
securityfocus.com/archive/1/483357/100/0/threaded
Show 41 moreShow less
us-cert.gov/cas/techalerts/TA07-352A.html
debian.org/security/2008/dsa-1570
issues.rpath.com/browse/RPL-1738
mail.gnome.org/archives/gtk-devel-list/2007-November/msg00022.html
lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
mandriva.com/security/advisories?name=MDKSA-2007:211
redhat.com/archives/fedora-package-announce/2008-March/msg00181.html
docs.info.apple.com/article.html?artnum=307179
novell.com/linux/security/advisories/2007_62_pcre.html
pcre.org/changelog.txt
exchange.xforce.ibmcloud.com/vulnerabilities/38277
bugs.gentoo.org/show_bug.cgi?id=198976
nvd.nist.gov/vuln/detail/CVE-2007-4767
github.com/advisories/GHSA-9cw9-v886-c24m
security-tracker.debian.org/tracker/CVE-2007-4767